'502 Bad Gateway from NGINX server

I'm currently in the process of swapping my app gateways in azure for nginx server. The nginx ingress has 2 servers - the first one in the path is the TLS nginx server and this forwards to a ReverseProxy nginx server which then points to an azure private load balancer. (Previously the app gateway pointed to this private load balancer)

I'm not very familiar with NGINX configs however and I running into an error when try and access my application URL. I am getting the below

502 Bad Gateway
nginx

Previously I was getting a blank page and the dev tool logs were showing a HTTP 426 error relating to http2 so I changed the config files and now am getting the above. Not sure if its progress since now I am actually hitting the nginx server or if its a step backwards. Nginx is running on the both servers and other sites are also using these servers and they are accessible

nginx version: nginx/1.19.5 (nginx-plus-r23)

My TLS config is like below

server{
  listen 443 ssl;
  server_name example.com;
  ssl_certificate /etc/nginx/ssl/fullchain.crt;
  ssl_certificate_key /etc/nginx/ssl/key.key;

  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
  ssl_session_cache    shared:SSL:10m;
  ssl_session_timeout  10m;

  keepalive_requests 100000;

  ssl_prefer_server_ciphers On;
  ssl_protocols TLSv1.2;
  ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!aNULL:!MD5:!DSS;


  location / {
    proxy_pass https://obc_backend;
    proxy_set_header ParentRequestID $parentrequest_id;
    add_header ParentRequestID $parentrequest_id;
    proxy_set_header Host $host;
    client_max_body_size 100M;
    proxy_connect_timeout 3m;
    proxy_send_timeout 3m;
    proxy_read_timeout 3m;

    proxy_http_version 1.1;
    proxy_set_header Connection "Upgrade";
    proxy_set_header Upgrade $http_upgrade;

    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }
}
upstream obc_backend {
   zone obc_backend 64k;
   server <reverseproxy_ip>:443 max_fails=0;
   keepalive 50;
}

My reverse proxy config is like below

server{
  listen 443 ssl http2;
  server_name example.com;
  ssl_certificate /etc/nginx/ssl/fullchain.crt;
  ssl_certificate_key /etc/nginx/ssl/key.key;

  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

  ssl_prefer_server_ciphers On;
  ssl_protocols TLSv1.2;
  ssl_ciphers "AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:AES128-GCM-SHA256:AES128-SHA256:AES128-SHA";
  access_log  /var/log/nginx/access.log main;
  error_log   /var/log/nginx/error.log;

  proxy_next_upstream error http_500 http_502 http_503 http_504 non_idempotent;
  proxy_next_upstream_tries 3;

  keepalive_requests 100000;
  set $real_ip $http_X-Real-IP;
  underscores_in_headers on;

  location / {
    location ^~ / {
      proxy_pass  http://http_obc_dev_aks_backend/;
      proxy_set_header ParentRequestID $parentrequest_id;
      proxy_set_header Host $host;
      proxy_set_header Connection "keep-alive";
      proxy_ssl_name $host;
      proxy_ssl_server_name on;
      client_max_body_size 100M;

      proxy_connect_timeout 3m;
      proxy_send_timeout 3m;
      proxy_read_timeout 3m;
    }
  }
}
upstream http_obc_dev__aks_backend {
        zone http_obc_dev_backend 64k;
        server <private_load_balancer_ip>:80;
        keepalive 40;
}


Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source